Connections and authentication
These commands connect the CLI to an SDK platform or to your Cloudflare account. They also manage the tokens the CLI uses.
On this pageSign in to an SDK platform · Authenticate with Cloudflare · Create tokens for automation
Requires: login to the destination
The CLI may open your browser to sign in to the destination. Credentials go to your system keychain, not your project.
Now you will connect the project to a deploy destination.
void connect
void connect platform.example.comExample output: the CLI confirms the destination. It opens a browser sign-in if needed.
Next, pick a destination type directly.
void connect --platform cloudflare
void connect --platform voidExample output: the CLI confirms the destination. It opens a browser sign-in if needed.
void connect links a project to its deploy destination. With no arguments, you choose Cloudflare or an SDK platform from a menu. A URL selects an SDK platform directly. --platform void lists saved platforms and lets you enter another URL.
You can pass a hostname. void connect platform.example.com connects over HTTPS. Loopback hosts (localhost, 127.0.0.1 and [::1]) use HTTP by default. For a local platform, use void connect localhost:8787. This also works in the prompt. Add a scheme to override the default, for example void connect https://localhost:8787.
For Cloudflare, the SDK signs in through the browser when needed and picks an account you can access. It saves cloudflare.account_id in void.config.ts, or resolved state in void.lock.json. void init uses the same setup. An existing account choice is kept. Resolve conflicting or inaccessible account settings before you continue.
For an SDK platform, the SDK checks the connection and signs you in through your browser when needed. It saves credentials in your system keychain, separately for each platform.
The deploy preference is saved in .void/project.json. Connecting to another SDK platform keeps an existing project link. The CLI tells you when that link or an env override still points elsewhere. Use void project link to choose a project. Choosing Cloudflare also keeps existing SDK project data, so you can switch back later.
In a non-interactive shell, pass a URL or an explicit target. Cloudflare needs working credentials and one clear account (set CLOUDFLARE_ACCOUNT_ID when needed). For an SDK platform, provide VOID_TOKEN with a matching VOID_API_URL, or reuse a valid keychain session for that origin. Use void connect <url> --no-login to save the checked connection without signing in. This option only works for SDK platforms.
Authentication
void auth login, void auth status and void auth logout use the destination that void init or void connect saved for the project. If none is saved, interactive commands let you pick Cloudflare or a connected SDK platform. In a non-interactive shell, pass --platform cloudflare|void, or use the void cloudflare and void account commands. Choosing a destination for sign-in does not change the project's deploy target.
SDK platform account
void account login
Signs in through the browser with one of the platform's enabled methods. The token is saved in the system keychain, scoped to the platform origin. If no keychain exists, login fails rather than write the token to a plain-text file. Headless environments use VOID_TOKEN from their secret manager.
Connect to a platform with void connect <url> before you sign in. If an older project link has no platform URL, connect, then run void project link to select its project again.
Set VOID_API_URL with VOID_TOKEN to name the platform that issued the token. Env-based sign-in needs both, and the URL must already be connected. In a fresh CI environment, run void connect "$VOID_API_URL" --no-login before you deploy, in the same shell. To use a platform's saved login instead, unset VOID_TOKEN.
You can skip this if you already signed in during void connect or void init.
void account link [connection-id]
Links another enabled login method to your account. Sign in again if your session is not recent. Then finish the other provider's browser login and confirm the identity shown. Without a connection ID, you pick a method from a menu. The optional dashboard offers the same flow under Account.
void account logout
Removes the saved credentials.
void account whoami
Prints who you are signed in as.
void account token
Copies your personal auth token to the clipboard. Use it only for interactive troubleshooting. It is revoked if its login method is revoked. Never use it with a Cloudflare Access service token for CI. Machine Access proof cannot turn a personal SDK token into an automation identity. For CI, create a project credential with void project token create.
Cloudflare authentication
Use the SDK's Cloudflare commands to sign in and manage credentials. You do not need a separate Cloudflare CLI. Browser credentials are encrypted and protected by your system keychain.
void cloudflare login— sign in through your browser or switch Cloudflare users.void cloudflare status— show your identity, credential source, accessible accounts, and deployment account.void cloudflare logout— remove the local browser session.
Interactive void connect --platform cloudflare, void init and void deploy --platform cloudflare start the same login flow when needed. Non-interactive CI must set CLOUDFLARE_API_TOKEN from its secret store.
Signing in changes the browser session, not account_id in the project config. Run void cloudflare status after you switch users. If the new user cannot access the pinned account, fix the project target before you deploy.
An API token or global API key pair in the environment wins over browser credentials. Browser login stops and names these overrides. Remove them from that shell before you sign in. status reports the active credential source. logout warns if env credentials are still active. Browser login needs an interactive terminal. Automatic deploy checks keep reusing valid sessions.
